authom is an authentication library for node.js. It unifies authentication APIs for multiple services into a single EventEmitter, and works with both the built-in node.js HTTP module and as an Express/Connect app.

authom was designed to solve one problem and solve it well. It has an intuitive node.js-like API, no required dependencies, and doesn't force any particular persistence, session, or middleware approaches on you.

And then head to http://authom.jedschmidt.com (which resolves to your local machine at 127.0.0.1). sudo is needed to bind to port 80, as many providers do not allow callback URLs with a port or localhost as the host.

authom aims to solve a smaller problem, more agnostically. It trades convenience for simplicity and flexibility. Here are some key differences:

authom was built for node, and can also work with Express, while everyauth is tied to Express and Connect. everyauth aims for a much more ambitious integration, but at the expense of locking you into a particular stack. authom takes a more UNIX approach; since it doesn't handle logins, persistence, sessions, or anything past authentication, it is more of a tool and less of a framework.

authom uses native node.js conventions such as EventEmitters and objects, while everyauth uses promises and a chaining config API. This is of course subjective, but the authom API aims to be closer to the APIs of node.js itself.

Creates an EventEmitter for the given authentication service. The service is specified by the service key of the options object, with all other keys differing based on the service. For example, github would be called like this:

var github =authom.createServer({

service:"github",

id:"7e38d12b740a339b2d31",

secret:"116e41bd4cd160b7fae2fe8cc79c136a884928c3",

scope:["gist"]

})

An optional name member can also be passed to override that used for authom path matching. So if you had two GitHub apps, you could set them as name: github1 and name: github2, so that they could be accessed as /auth/github1 and /auth/github2.

You can listen for auth and error events by:

listening to a specific service for service-specific events, or

listening to authom for all service events

For example, use this to listen for events from GitHub, based on the code above:

github.on("auth",function(req,res,gitHubSpecificData){})

github.on("error",function(req,res,gitHubSpecificData){})

Or, use this to listen to events from all provders, since authom already listens and namespaces them for you:

Listens for successful authentications across all services. The listener is called with the original request/response objects as well as a service-specific user object, which contains the following keys:

token: the token resulting from authentication

refresh_token: the refresh_token resulting from authentication, if implemented by auth service, otherwise undefined

id: the ID of the user on the remote service

data: the original data returned from the service, and

service: the name of the service, given so that you can branch your code:

Listens for failed authentications across all services. Like the auth event, the listener is called with the original request/response objects as well as an error object, allowing you to provide your own session scheme.

Authom-compliant services can be registered using this method. This is useful for adding custom authentication services not suited to be part of the /lib core services. (For example a business-specific in-house authentication service.) Custom services will override existing services of the same name.

fields: Optional. Comma separated (no spaces) String with the linkedIn fields to include in the query, fe: "first-name,last-name,picture-url,industry,summary,specialties,skills,projects,headline,site-standard-profile-request"

To add an authentication service provider, add a javascript file for the service at the path /lib/services/<service-name>.js. This file should module.exports a constructor that returns an EventEmitter that listens for request events, and emits auth and error events to itself.

var EventEmitter =require("events").EventEmitter

module.exports=function(options){

var server =newEventEmitter

server.on("request",function(req,res){

// respond to the request, redirecting the user as needed

if(successful){

// pass an object containing the service's user data

server.emit("auth", req, res, obj)

}

else{

// pass an object containing an error message

server.emit("error", req, res, obj)

}

})

return server

}

To make sure that your code can recieve subsequent HTTP(S) calls from the service, use the inbound req.url as the callback URL, using the querystring to disambiguate different stages of the authentication process. See /lib/services/github.js for an example implementation.

Once you're done, and have written tests, make sure you open a pull request so that the rest of us can benefit!

Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.